c8d106fef42c041ca80f34ac403aa1e487f1f7fd594211cca3c113594e585b17

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe
Size 1.0MB
Sample260817-bckdpscq7s
SHA256 c8d106fef42c041ca80f34ac403aa1e487f1f7fd594211cca3c113594e585b17
MD5 1381822b4eb2bac96dedf27cc5e6cfdc
SHA1 ca1112945a1f9ae91a0bd88f5a7b614ef47cfdad
SHA512 ffdc8150805964dda52c19d29a9eac0a7496318e14324bd2132892bae43b457a9ff29b741273a318479f3a6b0939c7b4b0aae2131f2397b9ae9c4e1c68303579
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso2:jxPAPJmtv
TLSH
T11C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5112	wyyqk.exe
5820	womgu.exe
6084	waccnva.exe
5924	wmdbi.exe
2448	wfjvsqr.exe
5752	wifgnn.exe
2484	wlor.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\waccnva.exe	womgu.exe
File created	C:\Windows\SysWOW64\womgu.exe	wyyqk.exe
File opened for modification	C:\Windows\SysWOW64\wfjvsqr.exe	wmdbi.exe
File opened for modification	C:\Windows\SysWOW64\wifgnn.exe	wfjvsqr.exe
File created	C:\Windows\SysWOW64\wlor.exe	wifgnn.exe
File created	C:\Windows\SysWOW64\wyyqk.exe	2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wyyqk.exe	2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wmdbi.exe	waccnva.exe
File opened for modification	C:\Windows\SysWOW64\wmdbi.exe	waccnva.exe
File created	C:\Windows\SysWOW64\wfjvsqr.exe	wmdbi.exe
File opened for modification	C:\Windows\SysWOW64\wlor.exe	wifgnn.exe
File opened for modification	C:\Windows\SysWOW64\womgu.exe	wyyqk.exe
File created	C:\Windows\SysWOW64\waccnva.exe	womgu.exe
File created	C:\Windows\SysWOW64\wifgnn.exe	wfjvsqr.exe
File created	C:\Windows\SysWOW64\wlgqsu.exe	wlor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5468	2484	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	waccnva.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wfjvsqr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wifgnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wyyqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmdbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	womgu.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 5112	3948	2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe	89
PID 3948 wrote to memory of 5140	3948	2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe	90
PID 5112 wrote to memory of 5820	5112	wyyqk.exe	93
PID 5112 wrote to memory of 1524	5112	wyyqk.exe	94
PID 5820 wrote to memory of 6084	5820	womgu.exe	97
PID 5820 wrote to memory of 1484	5820	womgu.exe	98
PID 6084 wrote to memory of 5924	6084	waccnva.exe	100
PID 6084 wrote to memory of 3704	6084	waccnva.exe	101
PID 5924 wrote to memory of 2448	5924	wmdbi.exe	103
PID 5924 wrote to memory of 2952	5924	wmdbi.exe	104
PID 2448 wrote to memory of 5752	2448	wfjvsqr.exe	106
PID 2448 wrote to memory of 2500	2448	wfjvsqr.exe	107
PID 5752 wrote to memory of 2484	5752	wifgnn.exe	109
PID 5752 wrote to memory of 4256	5752	wifgnn.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\wyyqk.exe
  "C:\Windows\system32\wyyqk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\womgu.exe
    "C:\Windows\system32\womgu.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\waccnva.exe
      "C:\Windows\system32\waccnva.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\Windows\SysWOW64\wmdbi.exe
        
        "C:\Windows\system32\wmdbi.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5924
      - C:\Windows\SysWOW64\wfjvsqr.exe
        
        "C:\Windows\system32\wfjvsqr.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\wifgnn.exe
        
        "C:\Windows\system32\wifgnn.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Windows\SysWOW64\wlor.exe
        
        "C:\Windows\system32\wlor.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2484
        
        C:\Windows\SysWOW64\wlgqsu.exe
        
        "C:\Windows\system32\wlgqsu.exe"
        9⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlor.exe"
        9⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 1788
        9⤵
        Program crash
        
        PID:5468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wifgnn.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfjvsqr.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmdbi.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\waccnva.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\womgu.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyyqk.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-16_1381822b4eb2bac96dedf27cc5e6cfdc_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2484 -ip 2484
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NYWQ12\install[2].htm
Size 1KB
SHA256 73f091e944f1a2133646754dd3e5a9480f941987498a5120579e2eb4b5b0d696
MD5 96a1a28fc6b2748c5825ecd901e4be3f
SHA1 a467fb3522cc2152b0cd4e39198f79f96e54c453
SHA512 c0aec69d9585741c0b0f7fa287bd47c8cb6660aaf700b5d70c77c2112c81ae2bf69be95315ba89ac1de4715c7f956db6c1d1a07e282353dfaaf3a2a6cf7bf5ec
TLSH
T1E411393707405415A861419C2DB1327DB44568DEFB2BCA71DF5FE3A14DD2FC149A5504
MD5 SHA1 SHA512 TLSH

Submit Download

waccnva.exe

Path C:\Windows\SysWOW64\waccnva.exe
Size 1.0MB
SHA256 822dfff15797d84b28146a7bd14bee2b1de1144a8ac2a6fa4022a56aa4f193b9
MD5 9ddff20b4ec6d237d66b41c4ca7281c5
SHA1 f9bf5e94322bb976c7cc38b95e0a009031ccfe80
SHA512 b76798cee3f89b42149e5e6fa154102007c89894166d8a764c8ce12edbdc25845bc7f792abf026bb31022504ae7f0dd51283521635e147e5d1236d64b635a4f9
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoK:jxPAPJmtx
TLSH
T16B35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wfjvsqr.exe

Path C:\Windows\SysWOW64\wfjvsqr.exe
Size 1.0MB
SHA256 5e771a07779e4f117c6ee7f462a2fd5ffa7a343abff66c3bf7ac64335c845bf5
MD5 4b51005a179a00cd640a0b3ea4279fb9
SHA1 05ea83b0233cd98a45b88962e44ee6296b5f8e51
SHA512 fde6a8f86ccbabebef31a771fe6d4f664d2e64c9b77cdbfb56f00242502a1d23450bb38a16d0d39109181be1985071135f8b75e5b9338ec068cca694c22b939c
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsov:jxPAPJmtA
TLSH
T10835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wifgnn.exe

Path C:\Windows\SysWOW64\wifgnn.exe
Size 1.0MB
SHA256 9620409302f9ebd05b95a1dc3e0776ac8e45c20495487a0cc6a9dfbc6c9c5ff2
MD5 67ccfb69a08ae1cc3bc02db774a333e7
SHA1 ac360d98ff8ab009b0e2c8366f59739400ab5bae
SHA512 ba5d5d971b677921941bc6cccabbe736932c291d622146660f23fc29fa7c7ed833008818af4e593cdee6b0bacc6700cedb24e93b9cf94d928e4103199ed85a42
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoo:jxPAPJmtR
TLSH
T11735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlgqsu.exe

Path C:\Windows\SysWOW64\wlgqsu.exe
Size 1.0MB
SHA256 461fe8898526d0e589e68190e600a5d838168fd09b46e264b3ae94b3dd370992
MD5 d7af2f10070184c136251d311cee5e51
SHA1 fecd0c4e8ddfb612f4b4972e945fb7d817c61429
SHA512 91ff2fcfc4628fab832209af1233d800e988acaef795671b0d90d970c2f0af92b3d9c62c3618bf4474e5d78934f84271eaf33206f35c37005f8457fbba29198f
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoK:jxPAPJmtj
TLSH
T19F35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlor.exe

Path C:\Windows\SysWOW64\wlor.exe
Size 1.0MB
SHA256 418951c390855aef05fc201b174978a76a6a752a747a0429b8d8813302774349
MD5 f511902e65c3f3b51fc267048ede34b1
SHA1 1483872beb8fc88df435851b2638fa4fbd1d8daa
SHA512 e37bcdbedb725a0395391870a3f7ba5b091b54e286e6fd31b0b7cdd4699ce4ff38870ca370136b67a9cb594707f4fb6d9afb870488d02ab5637b2bf29cef2600
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmta
TLSH
T14635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmdbi.exe

Path C:\Windows\SysWOW64\wmdbi.exe
Size 1.0MB
SHA256 a9b7428cef9762cb3ca84085e585ef887cbc0229440a14863ba8053f2798dfb5
MD5 68b0fbe427cb09e5a122889f4b1ac6c3
SHA1 5175b14df2d6a356a057b1cc8bec02e82ddfc155
SHA512 58ab2c8516395f25ed272add548b82258afd52d0a63c46c43872027bdf6824c1f331ff7814bbd5c7bc72d01ca6993039b50e67b5ac5f0e44b81d9dc1e9675394
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoT:jxPAPJmta
TLSH
T19C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

womgu.exe

Path C:\Windows\SysWOW64\womgu.exe
Size 1.0MB
SHA256 ebd33d9a1a98c94919f3782e642adc3ad2ef7acaaec280c62880c02f3179869f
MD5 acf8755e83dcaa9ff4362781a81c0bb0
SHA1 06dadfbb0001ac7b4d0acae9734639f79819c6b0
SHA512 4d77a25a7290e7618ae8ae822a115852bc8b5c5f55d72875e0daafd12540b2b0c028f27f4cf0ad21e6bba87f9babbffcc9a2b44abdc7b16c50899d674ed0c1ca
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoV:jxPAPJmtw
TLSH
T15935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wyyqk.exe

Path C:\Windows\SysWOW64\wyyqk.exe
Size 1.0MB
SHA256 d374931a3146cd535399fe7159571ea08a2f88a55e33797a19e1f6f94bdd2151
MD5 1319b9478dcbb1e4223e098dfa6c4a46
SHA1 af9625f88e4bb897401e9d613b65ff1aba5ab190
SHA512 90267cf1ad1009179d72c00a1c8cc679d993a375c3bb2135c685377ff569bdf62f7a7633b09d97df3c5dafb92301cde35bbdc55b3b082a7b53ef948cc7190fa2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmt/
TLSH
T15C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-106-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2448-68-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2448-82-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2484-108-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2484-93-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3948-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3948-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3948-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5112-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5112-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5112-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5752-95-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5752-83-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5752-81-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5820-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5820-41-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5820-29-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5924-69-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5924-56-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5924-54-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6084-55-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6084-42-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/6084-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads